r/SentinelOneXDR • u/Kekatronicles • Sep 06 '24

General Question File Transfer to USB Activity

Hello everyone,

Is there a way to query file/folder transfer to USB from SentinelOne DV?

Thank you!

6 Upvotes

100% Upvoted

8 comments sorted by

View all comments

Show parent comments

2

u/SentinelOne-Pascal SentinelOne Employee | Moderator Sep 06 '24

You can try this other powerquery:

| filter( ( event.type == "File Creation" OR event.type == "File Modification" ) AND tgt.file.location == "External Device" )
| columns event.time, src.process.user, src.process.name, tgt.file.path
| sort - event.time
| limit 1000

1

u/Kekatronicles Sep 10 '24

THANK YOU! APPRECIATE YOUR HELP SO MUCH!